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ABSTRACT OF THE DISCLOSURE 

[070] A system protects against loss of communication during network attacks. In a 

first implementation, a system (120) models the behavior of normal users in a network in 

response to an application of a first packet filtering technique. The system (120) receives 

a group of packets from a first user subsequent to the application of the first packet 

filtering technique and creates one or more models reflecting the behavior of the first user 

based on the received packets. In another implementation, a system (130) receives a 

stream of packets subsequent to a filtering technique being applied, partitions the packets 

into groups, where each group corresponds to more than one packet, and classifies each 

group of packets as a normal group or an attack group using one or more models. Each 

model reflects a normal response to an application of the filtering technique. The system 

(130) forwards groups classified as normal groups, thus preventing network attacks from 

choking off all communication in the network. 
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